Sav-Rx, a medication benefits management service provider, experienced a data breach incident that potentially exposed the personal and health information of more than 2.8 million individuals in the United States.
Sav-Rx, operating under A&A Services, provides medication benefits management services to various health plans, which requires collecting and storing personal data from health plan participants and employees.
The incident was first detected on October 8, last year, when the company identified an unauthorized access to its computer network, a breach notification to the Maine Attorney General said. Sav-Rx engaged third-party cybersecurity experts to contain and investigate the breach.
The affected IT systems were restored the next business day, ensuring no disruption to patient care or prescription services. The investigation revealed that an unauthorized third party accessed non-clinical systems and obtained files containing personal and health information, such as:
- names,
- dates of birth,
- social security numbers,
- email addresses,
- physical addresses,
- phone numbers,
- eligibility data, and
- insurance identification numbers.